Certificate Manager concepts

Certificate Manager is a service to manage TLS certificates in Yandex Cloud. You can use the service to issue and renew Let's Encrypt certificates or add custom certificates.

Certificate typesCertificate types

Certificate Manager supports two types of certificates:

• Let's Encrypt certificates (Managed): Certificates issued through Let's Encrypt and managed by Certificate Manager. For more information about these certificates, see Let's Encrypt certificate.
• Custom certificates (Imported): Certificates added by the user. Timely renewal of such certificates is under your own responsibility. For more information about these certificates, see User certificate.

Certificate statusesCertificate statuses

The lifecycle and statuses of certificates depend on their type.

• Let's Encrypt certificates (Managed) can have the following statuses:
  • Validating: Certificate was requested from Let's Encrypt and is awaiting a successful domain ownership verification.
  • Issued: Certificate was issued and can be used in services integrated with Certificate Manager.
  • Invalid: Certificate failed the verification: the domain ownership verification procedure took more than one week or failed.
    • Renewing: Certificate is being renewed.
    • Renewal_failed: Renewal failed.
• Custom (Imported) certificates always have the Issued status: the certificate was issued and can be used in services integrated with Certificate Manager.

Sending notifications to usersSending notifications to users

If the certificate is about to expire and could not be reissued automatically, you will get notified and prompted to pass the domain ownership verification procedure or upload a new version of the certificate.

Where notifications are sentWhere notifications are sent

Notifications are sent to:

• The email address specified in the cloud settings.
• Additional email addresses that are subscribed to notifications.

When notifications are sentWhen notifications are sent

Deadline for sending notifications:

• 21, 7, and 3 days before the certificate expires.
• After its expiration date.

Monitoring the status of certificatesMonitoring the status of certificates

You can set up metrics and alerts for certificate monitoring. You can see metric charts on the service dashboard, which is created automatically.

List of certificate metrics:

• certificate.days_until_expiration: Shows the real number of days until a certificate's expiration date.

  You can use this metric to create alerts about the upcoming expiration of the certificate.

• certificate.is_out_of_order: Shows whether the certificate can be used for a TLS connection.

  • The metric equals one if the certificate cannot be used for a TLS connection, i.e., its status is Invalid, Revoked, or its validity period has expired.

  • In all other cases, the metric equals zero, including when the certificate's status is Validating.

    You can use this metric to create alerts to warn you about an out-of-order certificate.

• quota.certificates_count.usage: Shows the current usage of the quota for the number of certificates per cloud.

• quota.certificates_count.limit: Shows the current limit on the number of certificates per cloud.

You can use metrics to create alerts. For more information, see Adding an alert for a certificate.

Useful linksUseful links

• Services integrated with Certificate Manager
• Domain ownership verification